{"id":"CVE-2026-123621","kind":"vulnerability","aliases":["CVE-2026-123621"],"related":[],"title":"Usermin: email attachment names let remote senders overwrite files, run commands","description":"Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unauthenticated attackers to write files outside the temporary directory via unsanitized attachment filenames. Attackers can email attachments with ../ sequences in filenames, and when the recipient downloads all attachments, files like ~/.forward are overwritten, enabling command execution.","summary":"Usermin through 2.570 fails to sanitize attachment filenames in mailbox/detachall.cgi, so path traversal sequences like ../ write files outside the temporary directory. An unauthenticated attacker who emails a crafted attachment can overwrite files such as ~/.forward when the recipient downloads all attachments, enabling command execution.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email","runtime","self-hosted","usermin","webmin"],"not_affected_if":["mailbox-module-disabled","usermin-not-installed"],"how_to_check":"- Check the installed Usermin version, for example with `usermin -v` or the package manager, and compare it to the fixed range in the product data.\n- Confirm whether the mailbox/detachall.cgi module is enabled in the Usermin web interface.","fix":"- Upgrade Usermin past 2.570 to the fixed version; the exact version is unknown from the sources given.","status":"open","published_at":"2026-11-06T15:17:19+00:00","first_seen_at":"2026-11-06T15:42:44+00:00","triaged_at":"2026-11-06T15:43:58+00:00","updated_at":"2026-11-06T15:43:58+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-06T15:43:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Usermin past 2.570 to the fixed version; the exact version is unknown from the sources given.","reach":"internet","title":"Usermin: email attachment names let remote senders overwrite files, run commands","impact":"high","summary":"Usermin through 2.570 fails to sanitize attachment filenames in mailbox/detachall.cgi, so path traversal sequences like ../ write files outside the temporary directory. An unauthenticated attacker who emails a crafted attachment can overwrite files such as ~/.forward when the recipient downloads all attachments, enabling command execution.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["usermin","webmin","self-hosted","email"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker overwrites ~/.forward and runs commands as the mailbox user","analyst_note":"Confirm the fixed Usermin version and whether mailbox/detachall.cgi is reachable by default; check the linked patch on github.com and the VulnCheck advisory.","how_to_check":"- Check the installed Usermin version, for example with `usermin -v` or the package manager, and compare it to the fixed range in the product data.\n- Confirm whether the mailbox/detachall.cgi module is enabled in the Usermin web interface.\n- unknown for other checks.","plain_action":"","needs_analyst":true,"not_affected_if":["usermin-not-installed","mailbox-module-disabled"],"who_is_affected":"Servers running Usermin through 2.570 with the mailbox module are exposed, because mail sent to a mailbox user can reach the vulnerable download path. Systems where Usermin is not installed, or where the mailbox module is not in use, can skip it. Whether an attacker needs access beyond sending mail is unknown from the sources.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000767,"input_tokens":4291,"output_tokens":676,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123621':14A,17A '-2026':13A,16A '/.forward':59B,112C '2.570':27B,71C 'allow':80C 'attach':3A,31B,53B,65B,93C,98C,109C 'attack':48B,83C,95C 'command':11A,67B,116C 'contain':72C 'craft':52B 'cve':12A,15A 'directori':45B,90C 'download':63B,107C 'email':2A,18B,50B,97C 'enabl':66B,115C 'execut':68B,117C 'fail':28B 'file':9A,41B,56B,86C,110C 'filenam':32B,94C,102C 'host':22B 'let':5A 'like':39B,111C 'mailbox/detachall.cgi':34B,78C 'name':4A 'outsid':42B,87C 'overwrit':8A,55B 'overwritten':114C 'path':36B,74C 'recipi':62B,106C 'remot':6A,81C 'run':10A 'runtim':19B 'sanit':30B 'self':21B 'self-host':20B 'sender':7A 'sequenc':38B,100C 'temporari':44B,89C 'travers':37B,75C 'unauthent':47B,82C 'unsanit':92C 'usermin':1A,23B,25B,69C 'via':91C 'vulner':76C 'webmin':24B 'write':40B,85C","nicknames":[],"mitigations":[],"who_affected":"Servers running Usermin through 2.570 with the mailbox module are exposed, because mail sent to a mailbox user can reach the vulnerable download path. Systems where Usermin is not installed, or where the mailbox module is not in use, can skip it. Whether an attacker needs access beyond sending mail is unknown from the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["email","high","runtime","selfhosted","usermin","webmin"],"campaign_type":null,"search_a":"'-123621':14A,17A '-2026':13A,16A 'attach':3A 'command':11A 'cve':12A,15A 'email':2A 'file':9A 'let':5A 'name':4A 'overwrit':8A 'remot':6A 'run':10A 'sender':7A 'usermin':1A","search_b":"'/.forward':59B '2.570':27B 'attach':31B,53B,65B 'attack':48B 'command':67B 'craft':52B 'directori':45B 'download':63B 'email':18B,50B 'enabl':66B 'execut':68B 'fail':28B 'file':41B,56B 'filenam':32B 'host':22B 'like':39B 'mailbox/detachall.cgi':34B 'outsid':42B 'overwrit':55B 'path':36B 'recipi':62B 'runtim':19B 'sanit':30B 'self':21B 'self-host':20B 'sequenc':38B 'temporari':44B 'travers':37B 'unauthent':47B 'usermin':23B,25B 'webmin':24B 'write':40B","search_c":"'/.forward':112C '2.570':71C 'allow':80C 'attach':93C,98C,109C 'attack':83C,95C 'command':116C 'contain':72C 'directori':90C 'download':107C 'email':97C 'enabl':115C 'execut':117C 'file':86C,110C 'filenam':94C,102C 'like':111C 'mailbox/detachall.cgi':78C 'outsid':87C 'overwritten':114C 'path':74C 'recipi':106C 'remot':81C 'sequenc':100C 'temporari':89C 'travers':75C 'unauthent':82C 'unsanit':92C 'usermin':69C 'via':91C 'vulner':76C 'write':85C","first_public_at":"2026-11-06T15:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123621","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123621","severity":null,"published_at":"2026-11-06T15:17:19+00:00","modified_at":"2026-11-06T15:17:19+00:00","first_seen_at":"2026-11-06T15:42:44+00:00","fetched_at":"2026-11-06T15:42:44+00:00","note":null}],"documents":[{"id":87577,"url":"https://github.com/webmin/usermin/commit/cb4614e8319e0932b10533a4d5606debf5f40e14","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":87578,"url":"https://www.vulncheck.com/advisories/usermin-through-2.570-path-traversal-file-write-via-detachall-cgi","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}